Ninja Forms CVE-2026-92438

Requires the target WordPress site to run Ninja Forms 3.15.3 with at least one publicly accessible form; the attacker submits a script payload into a form field that is stored without output escaping. Execution is NOT automatic on submission - it is gated by required user interaction (UI:R): a high-privileged user (administrator) must open the malicious submission on the admin submission-edit screen for the script to run in their authenticated session. No authentication is needed to plant the payload (PR:N), but the impact depends on an admin reviewing submissions, which is the normal operational workflow, making the gate weak in practice.

This is a stored (persistent) cross-site scripting flaw: an unauthenticated attacker submits a malicious payload through a public Ninja Forms form, and the script executes when a high-privileged administrator opens that submission on the admin edit screen. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H = 8.8) captures the unauthenticated network delivery and the required admin interaction, but the C:H/I:H/A:H with S:U appears over-scoped for a reflected/stored XSS payload - XSS impact is normally partial (C:L/I:L) with a scope change (S:C) because the script executes in the victim admin's browser context rather than granting direct full compromise; a realistic base score is closer to ~6.1. The signals are mixed: a public exploit reference exists (WPScan advisory), which raises practical concern, but there is NO CISA KEV listing and no EPSS score supplied, so there is no evidence of widespread automated exploitation. The real-world risk is meaningfully gated by UI:R - an admin must actually review the attacker's submission - but because reviewing form submissions is the normal workflow for this plugin, that gate is weak in practice and admin-context XSS can escalate to session/account takeover. Net: a genuine priority for sites running the affected version, but the vendor's 8.8 likely overstates raw technical impact.

An attacker fills out any public-facing Ninja Forms form on the target WordPress site, placing a JavaScript payload (e.g., an <img onerror> or <script> string) into a text field that is stored without output escaping. When a site administrator later opens that submission on the admin submission-edit screen to review it, the payload executes in the admin's authenticated browser session, enabling actions such as anti-CSRF token theft, admin session hijacking, or creation of a rogue admin account. A public exploit/advisory is available via WPScan, lowering the barrier to reproduction.